I'm experiencing a repeatable crash the *second* time I remove a
Cardbus EVDO card.  Here's what the attach looks like:

	ohci0 at cardbus0 function 0: NEC USB Host Controller (rev. 0x43)
	ohci0: interrupting at 11
	ohci0: OHCI version 1.0
	usb3 at ohci0: USB revision 1.0
	uhub3 at usb3
	uhub3: NEC OHCI root hub, class 9/0, rev 1.00/1.00, addr 1
	uhub3: 1 port with 1 removable, self powered
	ohci1 at cardbus0 function 1: NEC USB Host Controller (rev. 0x43)
	ohci1: interrupting at 11
	ohci1: OHCI version 1.0
	usb4 at ohci1: USB revision 1.0
	uhub4 at usb4
	uhub4: NEC OHCI root hub, class 9/0, rev 1.00/1.00, addr 1
	uhub4: 1 port with 1 removable, self powered
	umodem0 at uhub3 port 1 configuration 1 interface 0
	Jan  2 17:30:24 berkshire /netbsd:
	umodem0: Curitel Communications, Inc. Curitel Communications, Inc., rev 1.10/0.00, addr 2, iclass 2/2
	umodem0: data interface 1, has CM over data, has break
	umodem0: status change notification available
	ucom0 at umodem0

I run ppp; on exit; I run

	drvctl -d ohci0; drvctl -d ohci1

The first time, everything is fine.  The second time, though, the system
crashes.  Worse yet, I don't get a crash dump; savecore says that there's
an invalid PTE and refuses to proceed, even with -f.  

Eyeballing the panic, it says "ohci_intr:... bad address" followed by
a uvm_fault.  These are both consistent with a bad PTE...

The problem started some time after the PM merge.  A locking problem?
A register/deregister problem?  (It happened even before my addition
of pmf_register/pmf_deregister to ucom.c.  There are not yet any calls
to pmf_register/pmf_deregister in umodem.c; this needs to be fixed as well,
but I suspect it's a separate issue.)

Suggestions on how to approach debugging this?  The machine is a laptop
with no serial port, so I can't set up a serial console.

		--Steve Bellovin, http://www.cs.columbia.edu/~smb